What is "Phantom Wallet Identity Confirmation" email scam

What is "Phantom Wallet Identity Confirmation" scam?

After inspecting this email, we concluded it is a scam. It poses as an official compliance notice from "Blockchain Phantom Wallet" and falsely claims the recipient has over $1.2 million waiting in their account. The scammers behind it want to trick people into sending money and handing over sensitive identity documents. This email should be ignored.

"Phantom Wallet Identity Confirmation" email scam overview

The email arrives under the subject "URGENT ACTION REQUIRED" and presents itself as a critical security notice from a "Blockchain Phantom Wallet" compliance team. It tells the recipient that a sum of $1,200,820.21 has been identified in their account but is currently restricted and unavailable for transactions.

To release the funds, the email demands two things. First, the recipient must submit copies of a government-issued ID and a recent bank statement. Second, they must transfer $12,008.20 in cryptocurrency, framed as a mandatory "liquidity check" equal to 1% of the supposed total holdings.

The message insists this transfer is "NOT a fee or tax payment" and that the amount will remain as an "ADDITIONAL" credit to the account. These assurances are false. There are no held funds, no Blockchain Phantom wallet, and no pending transfer of any kind.

This is a textbook advance-fee scam. Scammers invent a large windfall owed to the target, then demand an upfront payment to "release" it. Anyone who complies loses the money sent and receives nothing. Further contact leads to escalating demands for additional payments under new pretexts.

Handing over personal documents carries a separate danger. Government-issued IDs and bank statements can be exploited for identity theft - used to open fraudulent accounts, take out loans, or commit financial crimes in the victim's name.

The email invokes Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations to appear legitimate. The real Phantom wallet (phantom.app) has no association with this scam or any of its operators.

Email scams in general

In conclusion, this is an advance-fee fraud email disguised as a compliance alert from a fake cryptocurrency wallet service. Its purpose is to extract an upfront payment and identity documents by inventing a large sum the recipient supposedly has access to. These emails are sometimes also used to deliver malware.

These types of fraudulent emails circulate widely online. More examples of similar scam emails are Suspicious Sign-In Attempt Blocked, Price Quotation Request, and DocuSign - Document Added To Your Account.

How do spam campaigns infect computers?

Spam emails can carry harmful content in the form of attachments or embedded download links. These files may take various formats - executables, compressed archives, PDF documents, Office files, or scripts. Opening or running such files can trigger malware installation, sometimes immediately and without additional prompts.

In other cases, emails include links to malicious websites that either automatically push downloads or prompt users to retrieve harmful files manually. Regardless of the method, an infection typically requires some form of user interaction - opening an attachment, clicking a link, or enabling certain features.

How to avoid installation of malware?

Treat unexpected emails carefully, especially those carrying attachments or embedded links. Do not open files or follow links in messages from unknown senders or senders whose legitimacy cannot be confirmed. Scammers often disguise dangerous content as urgent compliance notices or routine system alerts.

Download software exclusively from official websites and verified publisher pages. Avoid cracked programs, key generators, and third-party download platforms - these are common delivery vehicles for malware. Keep the operating system and all applications updated, and use reputable antivirus software for continuous protection.

If you have already opened a malicious attachment, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate any infiltrated malware.

Text presented in the "Phantom Wallet Identity Confirmation" email letter:

Subject: URGENT ACTION REQUIRED

Blockchain Phantom Wallet
Compliance & Security

CRITICAL SECURITY NOTICE:
Your Blockchain Phantom wallet requires immediate liquidity provisioning to avoid potential regulatory flags and ensure uninterrupted service continuity. This is a mandatory security measure required by our compliance department.

Dear Karolis,

We hope this message finds you well. We are pleased to inform you that we have identified a transfer of USD totaling $1,200,820.21 to your account. The funds are currently restricted and not available for any transactions. To ensure the security and integrity of our transactions, we require verification of your identity as the rightful owner of the account. This is a standard procedure designed to protect both parties involved and aligns with our commitment to compliance and transparency.

To proceed with the verification process, kindly respond to this email by providing us with copies of a government-issued identification document and a recent bank statement reflecting your current account details. These documents are crucial in confirming your identity and establishing trust within our financial operations.

Furthermore, in accordance with the latest Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations, we request that you initiate a transfer of 1% of the total amount ($12,008.20 USD) to demonstrate your ability to manage and access funds. It's important to note that this transaction serves as a liquidity check and does not constitute a fee. The transferred amount will be securely held in your BlockchainPhantom wallet.

Please ensure that the transfer is executed through an authorized, ASIC-regulated cryptocurrency exchange that has been verified under your name. This requirement ensures that all transactions adhere to strict regulatory standards and enhances the safety of your assets.

Required Action
Transfer Amount: $12,008.20 USD (1% of total holdings)
Destination: Your Phantom Wallet
Required Through: A regulated cryptocurrency exchange registered in your name (Any of the major cryptocurrencies)

Important Clarifications

This is NOT a fee or tax payment.
The transferred amount will be ADDITIONAL to your current balance.
All funds will remain accessible after completion.
This is a one-time security measure.

Time-Sensitive Instructions

1. Execute the transfer immediately.
2. Provide confirmation of the transfer.
3. Maintain all transaction records.

Regulatory Compliance

This measure is mandated by our Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols to ensure the security and integrity of our financial ecosystem.

If you have any questions regarding this liquidity check and to get back into your wallet account, feel free to contact us directly.

By completing these steps, you will not only facilitate a smooth transaction but also contribute to the overall security and reliability of our financial services. Should you have any questions or require further assistance, please do not hesitate to reply to us.

Thank you for your prompt attention to this matter and for your continued support.

Kind Regards,
Blockchain Phantom Compliance & Support Team

Full appearance of "Phantom Wallet Identity Confirmation" scam email (GIF):

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is Phantom Wallet Identity Confirmation phishing scam?
• Types of malicious emails.
• How to spot a malicious email?
• What to do if you fell for an email scam?

Types of malicious emails:

Phishing Emails

Most commonly, cybercriminals use deceptive emails to trick Internet users into giving away their sensitive private information, for example, login information for various online services, email accounts, or online banking information.

Such attacks are called phishing. In a phishing attack, cybercriminals usually send an email message with some popular service logo (for example, Microsoft, DHL, Amazon, Netflix), create urgency (wrong shipping address, expired password, etc.), and place a link which they hope their potential victims will click on.

After clicking the link presented in such email message, victims are redirected to a fake website that looks identical or extremely similar to the original one. Victims are then asked to enter their password, credit card details, or some other information that gets stolen by cybercriminals.

Emails with Malicious Attachments

Another popular attack vector is email spam with malicious attachments that infect users' computers with malware. Malicious attachments usually carry trojans that are capable of stealing passwords, banking information, and other sensitive information.

In such attacks, cybercriminals' main goal is to trick their potential victims into opening an infected email attachment. To achieve this goal, email messages usually talk about recently received invoices, faxes, or voice messages.

If a potential victim falls for the lure and opens the attachment, their computers get infected, and cybercriminals can collect a lot of sensitive information.

While it's a more complicated method to steal personal information (spam filters and antivirus programs usually detect such attempts), if successful, cybercriminals can get a much wider array of data and can collect information for a long period of time.

Sextortion Emails

This is a type of phishing. In this case, users receive an email claiming that a cybercriminal could access the webcam of the potential victim and has a video recording of one's masturbation.

To get rid of the video, victims are asked to pay a ransom (usually using Bitcoin or another cryptocurrency). Nevertheless, all of these claims are false - users who receive such emails should ignore and delete them.

How to spot a malicious email?

While cyber criminals try to make their lure emails look trustworthy, here are some things that you should look for when trying to spot a phishing email:

• Check the sender's ("from") email address: Hover your mouse over the "from" address and check if it's legitimate. For example, if you received an email from Microsoft, be sure to check if the email address is @microsoft.com and not something suspicious like @m1crosoft.com, @microsfot.com, @account-security-noreply.com, etc.
• Check for generic greetings: If the greeting in the email is "Dear user", "Dear @youremail.com", "Dear valued customer", this should raise suspiciousness. Most commonly, companies call you by your name. Lack of this information could signal a phishing attempt.
• Check the links in the email: Hover your mouse over the link presented in the email, if the link that appears seems suspicious, don't click it. For example, if you received an email from Microsoft and the link in the email shows that it will go to firebasestorage.googleapis.com/v0... you shouldn't trust it. It's best not to click any links in the emails but to visit the company website that sent you the email in the first place.
• Don't blindly trust email attachments: Most commonly, legitimate companies will ask you to log in to their website and to view any documents there; if you received an email with an attachment, it's a good idea to scan it with an antivirus application. Infected email attachments are a common attack vector used by cybercriminals.

To minimise the risk of opening phishing and malicious emails we recommend using Combo Cleaner Antivirus for Windows. 

Example of a spam email:

What to do if you fell for an email scam?

• If you clicked on a link in a phishing email and entered your password - be sure to change your password as soon as possible. Usually, cybercriminals collect stolen credentials and then sell them to other groups that use them for malicious purposes. If you change your password in a timely manner, there's a chance that criminals won't have enough time to do any damage.
• If you entered your credit card information - contact your bank as soon as possible and explain the situation. There's a good chance that you will need to cancel your compromised credit card and get a new one.
• If you see any signs of identity theft - you should immediately contact the Federal Trade Commission. This institution will collect information about your situation and create a personal recovery plan.
• If you opened a malicious attachment - your computer is probably infected, you should scan it with a reputable antivirus application. For this purpose, we recommend using  Combo Cleaner Antivirus for Windows.
• Help other Internet users - report phishing emails to Anti-Phishing Working Group, FBI’s Internet Crime Complaint Center, National Fraud Information Center and U.S. Department of Justice.

Frequently Asked Questions (FAQ)

Why did I receive this email?

Scam emails of this type are mass-distributed to large numbers of recipients. Cybercriminals gather addresses through data breaches, fake sign-up pages, and similar methods. The messages are generic and are not based on any real account or funds the recipient holds.

I have provided my personal information when tricked by this email, what should I do?

Change any compromised passwords right away. If you submitted identity documents or banking details, contact your bank and relevant authorities - such as a consumer protection agency or fraud helpline - to report potential identity theft and prevent further misuse of your information.

I have downloaded and opened a malicious file attached to an email, is my computer infected?

It depends on the file type. Executable files can compromise a device as soon as they are launched. Documents such as PDFs and Office files typically require an additional step - such as enabling macros - before malware can install and run.

I have read the email but did not open the attachment, is my computer infected?

No. Simply reading the email does not cause an infection. A device is only put at risk when the user actively opens an attachment or follows a malicious link contained in the message.

Will Combo Cleaner remove malware infections that were present in email attachment?

Yes. Combo Cleaner can detect and remove most known malware. Because advanced threats sometimes conceal themselves deep in the system, running a complete full-system scan gives the best chance of finding and eliminating all infections.